Bitwarden

The Bitwarden integration connects your Bitwarden organization to Oneleet through the Bitwarden Public API. It syncs your organization’s members and policies, and its monitors check that members use two-step login and that the organization’s policies require two-step login or SSO, set master password requirements, and enforce a session timeout.

Only workspace admins can connect the integration. The Public API is available on the Bitwarden Teams and Enterprise plans, and you need a Bitwarden organization owner to get the organization’s API key.

The policy monitors need the Enterprise plan

Bitwarden policies are only available on the Enterprise plan. A Teams organization has no policies to report, so the organization monitors fail for it until the organization moves to Enterprise.

Connect Bitwarden

Each connection uses one organization’s API key and syncs that organization. To monitor another organization, add a connection with that organization’s API key.

1. In the Bitwarden web app, open the Admin Console as an organization owner and select Settings > Organization info.

2. Under API Key, click View API key. Verify your identity and click View API key in the dialog, then copy the client_id and client_secret values.

3. In Oneleet, on the Integrations page, click Add integration, then click the Bitwarden card.

4. Paste the client_id into Client ID and the client_secret into Client Secret.

5. Enter the Authentication Endpoint and Base URL for the server your organization is on, from the table below, and click Connect.

Server	Authentication Endpoint	Base URL
Bitwarden cloud (US)	https://identity.bitwarden.com/connect/token	https://api.bitwarden.com
Bitwarden cloud (EU)	https://identity.bitwarden.eu/connect/token	https://api.bitwarden.eu
Self-hosted	https://your.domain.com/identity/connect/token	https://your.domain.com/api

For a self-hosted server, replace your.domain.com with your server’s domain. Oneleet’s servers must be able to reach it.

The organization API key has full access to your organization, so keep it private. Oneleet only uses it to read your members and policies.

Use the organization API key from the Admin Console, not a personal API key from your account settings. A personal key’s client_id starts with user. instead of organization., and Oneleet can’t sync the organization with it.

Synced assets

Oneleet syncs two kinds of assets:

• Bitwarden members: each confirmed member of the organization, with their name, email, and whether they’ve turned on two-step login. Invited members, members waiting for confirmation, and revoked members aren’t synced.
• Bitwarden organization: the organization, with whether the Require two-step login, Require single sign-on (SSO), Master password requirements, and Session timeout policies are on, and the master password requirements and session timeout settings that are set.

The Public API doesn’t return the organization’s name, so the organization asset is named after its organization ID. That’s the ID after organization. in the client_id.

Monitors

The integration adds four monitors. When one fails, its How to remediate section has the steps to fix it in Bitwarden.

• Bitwarden members have two-factor authentication enabled fails for each member who hasn’t turned on two-step login. It checks every synced member, including owners and admins.
• Bitwarden organizations require two-step login or SSO passes when the Require two-step login or Require single sign-on (SSO) policy is on.
• Bitwarden organizations enforce master password requirements passes when the Master password requirements policy is on, its Minimum character length and Minimum complexity score meet the monitor’s settings (see Master password settings), and Require existing members to change their passwords is selected. It doesn’t check the policy’s Character requirements.
• Bitwarden organizations enforce a session timeout passes when the Session timeout policy is on and its Maximum allowed timeout and Session timeout action meet the monitor’s settings (see Session timeout settings). Bitwarden doesn’t apply the policy to organization owners.

The Require two-step login and Require single sign-on (SSO) policies don’t cover owners and admins. Turning on Require two-step login doesn’t revoke an owner or admin who hasn’t set up two-step login, and Bitwarden doesn’t enforce Require single sign-on (SSO) for them. The member monitor checks their accounts instead.

Master password settings

The master password monitor has two settings in the Settings section of its page. Change a setting and click Save. The monitor checks the new values on its next hourly run. To check them now, click Rerun monitor.

Setting	What it requires	Allowed values	Default
Minimum length	The policy’s Minimum character length is at least this many characters	8 to 128 characters	12 characters
Minimum complexity	The policy’s Minimum complexity score is at least this score	Off, Good (3), or Strong (4)	Good (3)

A policy with no Minimum character length fails. A policy with no Minimum complexity score passes only when Minimum complexity is Off. When the policy is on, a failing result names each setting the policy doesn’t meet, and says so when Require existing members to change their passwords isn’t selected.

Session timeout settings

The session timeout monitor has three settings in the Settings section of its page. With the defaults, it passes when the Session timeout policy is on, its Maximum allowed timeout is Immediately, Custom, or On system lock, and its Session timeout action is Lock or Log out. Change a setting and click Save. The monitor checks the new values on its next hourly run. To check them now, click Rerun monitor.

Setting	What it requires	Allowed values	Default
Maximum allowed timeout	The policy’s Maximum allowed timeout is this option or a stricter one	Immediately, Custom, or On system lock	On system lock
Maximum custom timeout	When the policy’s Maximum allowed timeout is Custom, its Hours and Minutes add up to at most this many minutes	Empty, or 1 to 10,080 minutes (one week)	Empty, for no maximum
Required timeout action	The policy’s Session timeout action matches this setting	Lock or Log out, or Log out	Lock or Log out

Immediately is the strictest timeout, then Custom, then On system lock. On app restart and Never always fail. User preference, which lets each member choose their own action, always fails. A policy saved before Bitwarden added Maximum allowed timeout counts as Custom. When the policy is on, a failing result names each setting the policy doesn’t meet.